Fix infinite loop when requesting demand in SingleThreadedBufferingSubscriber

[yawkat]

I found this issue when debugging #6100. It is definitely a bug, but I am not sure yet how important it is to that issue.

Before this patch, requesting data from a SingleThreadedBufferingSubscriber when it is in BUFFERING state would cause an infinite loop.

request first registers the new demand, and then calls flushBuffer to fulfill some of the new demand using currently buffered data. If there was no previous demand, this happens in BUFFERING state. flushBuffer then tries to remove data from the buffer and submit it using onNext, until the buffer is empty or there is no more demand. However, in BUFFERING state, onNext simply readds the data to the buffer and does not touch the demand, so this is an infinite loop.

This fix extracts the "forwarding logic" in onNext to its own method, that does not consider the current state. flushBuffer now uses that method instead of onNext.